Repo brief: ever-co/ever-gauzy

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T17:22:36.115Z · commit a72669240816

Verdict

Mixed — Single-maintainer risk — review before adopting

• Last commit today
• 3 active contributors
• AGPL-3.0 licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

Ever Gauzy is an open-source monorepo implementing a full-stack business management platform (ERP/CRM/HRM/ATS/PM) built primarily in TypeScript with NestJS backends and Angular/React frontends. It provides enterprise features including human resources management, time tracking, employee performance monitoring, customer relationship management, project/task management, and financial accounting—all exposed via headless REST APIs. Monorepo structure: packages/auth/ contains multi-strategy OAuth and SSO orchestration (Auth0, Microsoft, Keycloak, Google, Facebook, LinkedIn, Fiverr) with controllers, strategies, guards, and MCP (authorization server) modules; packages/ likely contains core…

Start here

Open these first:

• packages/auth/src/index.ts — Entry point for the authentication module; exports all auth strategies and guards used across the platform.
• packages/auth/src/lib/social-auth.module.ts — Core NestJS module that configures and registers all OAuth/social authentication strategies (Auth0, Google, GitHub, etc.).
• packages/auth/src/lib/social-auth.service.ts — Main authentication service handling credential validation and user session management across all OAuth providers.
• packages/common/src/lib/interfaces/index.ts — Central configuration interface definitions for all external services (AWS, Google, Keycloak, etc.); required for…
• packages/config/src/lib/config.service.ts — Runtime configuration loader that reads environment variables and hydrates config interfaces; critical initialization step.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Evidence of package managers and build setup is not provided in the repository data (no package.json, Makefile, or docker-compose snippets shown). Verify the repository manifest before running setup: clone with `git clo…

Daily commands:

Setup commands cannot be reliably inferred from the provided data. Check package.json in the monorepo root for npm run dev or yarn dev. Given the Dockerfile presence and multi-service ERP nature, `docker-compose u…

…shortened for this brief.

Key cautions & unknowns

• Small team — 3 contributors active in recent commits
• Single-maintainer risk — top contributor 84% of recent commits
• AGPL-3.0 is copyleft — check downstream compatibility
• OAuth provider credentials: Each strategy (Google, Auth0, Microsoft, Keycloak) requires environment variables for client ID, secret, and callback URLs; misconfiguration silently breaks SSO. **MCP server mode vs.…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.